Add ocsp_require_stapling config option for tls - allows a connection

to indicate that it requires the peer to provide a stapled OCSP response
with the handshake.  Provide a "-T muststaple" for nc that uses it.
ok jsing@, guenther@

1 files changed, 7 insertions, 1 deletions

diff --git a/src/lib/libtls/tls_config.c b/src/lib/libtls/tls_config.c
index c07621acaf..5c73c29d65 100644
--- a/src/lib/libtls/tls_config.c
+++ b/src/lib/libtls/tls_config.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls_config.c,v 1.28 2016/08/22 14:55:59 jsing Exp $ */
+/* $OpenBSD: tls_config.c,v 1.29 2016/11/04 05:13:13 beck Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -621,6 +621,12 @@ tls_config_verify(struct tls_config *config)
 }
 
 void
+tls_config_ocsp_require_stapling(struct tls_config *config)
+{
+        config->ocsp_require_stapling = 1;
+}
+
+void
 tls_config_verify_client(struct tls_config *config)
 {
         config->verify_client = 1;